Packages / Sensitive Person Attributes
Sensitive Person Attributes
Special-category personal attributes such as biometrics, beliefs, vulnerability, and protected traits.
- Patterns
- 52
- As primary component
- 29
Patterns in this package
Reportable incident notifications and records under the aged care Serious Incident Response Scheme (SIRS), as continued by the Aged Care Act 2024 (Cth) and the Aged Care Rules 2025 from 1 November 2025, for a named older person receiving funded aged care services (residential care homes and services in home or community settings, including Support at Home). Covers the eight reportable incident types (unreasonable use of force, unlawful sexual contact or inappropriate sexual conduct, psychological or emotional abuse, unexpected death, stealing or financial coercion by a staff member, neglect, inappropriate use of a restrictive practice, unexplained absence from care) and the Priority 1 (report within 24 hours) / Priority 2 (report within 30 calendar days) classification. A populated record names the provider, the older person, the aged care worker or subject of allegation, the incident date, type and priority, and the response (police notified, medical treatment, supporters informed). ACQSC guidance, quick guides, SIRS statistics and blank forms are decoys. Structure modelled on au-ndis-reportable-incident, which covers the NDIS scheme; NDIS signals are excluded from this classifier's enforce tiers, but an aged care SIRS record can also reach 75 in the NDIS classifier because both share generic labels (provider, worker, date of incident).
Detects client, tenant, patient or customer case records that record a disclosure of domestic and family violence (DFV): case notes, intake assessments, service referrals and payment applications that name or number an individual and state that they have disclosed, experienced, fled or are at risk of DFV, coercive control or intimate partner violence. Sector-neutral: the same shape appears in housing, human services, health, education, justice and Commonwealth support records (Leaving Violence Program, the legacy Escaping Violence Payment, and Crisis Payment for extreme circumstances family and domestic violence). Also covers information-sharing requests and disclosures under Part 5A of the Domestic and Family Violence Protection Act 2012 (Qld) - s 169D (assessing a domestic violence threat), s 169E (responding to a serious domestic violence threat) and s 169F (police referral to a specialist DFV service provider) - made or received by prescribed entities (for example state schools, Hospital and Health Services, housing, corrections and police) and specialist DFV service providers, when the record names the requesting or disclosing entity, the person at risk or the person using violence, the information shared, the reason and the date. The Department of Education's Part 5A Instrument of Authorisation, which quotes s 169D verbatim, and the DFV Information Sharing Guidelines are decoys.
Detects records that disclose where a person at risk of domestic and family violence (DFV) is living or sheltering: refuge, shelter, safe house and crisis accommodation addresses, addresses flagged as confidential, suppressed or not to be disclosed, and silent elector entries. This is the highest-harm DFV disclosure, because it tells a person using violence where to find the victim-survivor. Sector-neutral: it applies to housing, human services, health, education, court, police, electoral and payroll records.
Detects charge sheets, court briefs, court lists, criminal histories and corrections records for domestic and family violence offences against an identified person: Queensland coercive control (Criminal Code s334C, from 26 May 2025) and engaging in domestic violence to aid a respondent (s179A); NSW abusive behaviour towards current or former intimate partners (Crimes Act s54D, from 1 July 2024); Tasmanian persistent family violence (Criminal Code s170A), economic abuse and emotional abuse or intimidation (Family Violence Act 2004 ss8-9); SA coercive control (Criminal Law Consolidation Act s20C, not yet proclaimed); contraventions of protection, intervention and restraining orders in every jurisdiction; and "domestic violence offence" notations (Qld Criminal Code s1 and Penalties and Sentences Act s12A; NSW Crimes (Domestic and Personal Violence) Act s12).
Detects police domestic and family violence (DFV) incident records and the referrals police send to specialist and government services: Queensland QPRIME DV occurrences, Victoria Police L17 Family Violence Reports, NSW DV events, and DFV incident, call-out and attendance records in other jurisdictions. These records travel beyond police to housing, child safety, health, education and specialist DFV services, so they turn up in general agency mailboxes and file shares.
Detects domestic and family violence protection orders, police-issued notices and directions, and applications for them, in every Australian jurisdiction, when the document names the parties. Covers Qld protection orders, temporary protection orders, Police Protection Notices and Police Protection Directions; NSW apprehended domestic violence orders (including provisional orders); Vic family violence intervention orders and family violence safety notices; WA family violence restraining orders; SA intervention orders; Tas police family violence orders and family violence orders; ACT family violence orders (interim and after-hours); NT domestic violence orders; and recognised DVOs under the National Domestic Violence Order Scheme. Complements the Queensland-specific domestic-violence-order-application classifier.
Detects completed domestic and family violence (DFV) risk assessments, safety plans and multi-agency risk meeting records for an identified person, across Australian frameworks: Qld Common Risk and Safety Framework (CRASF), QPS Domestic Violence Protective Assessment Framework (DV-PAF) and High Risk Teams; NSW Domestic Violence Safety Assessment Tool (DVSAT) and Safety Action Meetings; Vic MARAM; WA CRARMF; SA and NT Family Safety Framework meetings and Positive Action Plans; NT RAMF Common Risk Assessment Tool; and generic DFV risk assessments and safety plans.
Nationally Consistent Collection of Data on School Students with Disability (NCCD) records for a named student: disability category, level of adjustment and the evidence of adjustments provided.
School records showing that a student is the subject of a current family law order or a domestic violence order: the completed "Court Orders" section of the Queensland state school Application for Student Enrolment Form (SEF-1 V8, approved under the Education (General Provisions) Act 2006) - "Family Court Orders" (orders made pursuant to the Family Law Act 1975 concerning the welfare, safety or parenting arrangements of the student) and "Other Court Orders" (such as a domestic violence order) with commencement and end dates - and school file notes recording a parenting or protection order held for a student and the person who may not collect or contact the student. The blank SEF-1 form contains every anchor phrase and is a decoy; enforce tiers need populated order dates and a named student or restricted person. Complements au-qld-student-enrolment-form (form detection) and au-education-guardian-collection-record (collection permissions), which do not tier on court-order content.
Energy retailer customer records about hardship, payment plans, concessions and vulnerability. The National Energy Retail Law requires each retailer to have a customer hardship policy (s 43) meeting minimum requirements (s 44), and National Energy Retail Rules Part 3 (rr 70A-75B) sets out hardship customer obligations: informing the customer of the policy (r 71), payment plans set by capacity to pay, arrears and expected consumption (r 72), waiver of late payment fees (r 73), Centrepay (r 74) and the AER Customer Hardship Policy Guideline (r 75A). Queensland Government energy concessions (Electricity Rebate, Reticulated Natural Gas Rebate, Home Energy Emergency Assistance Scheme, Medical Cooling and Heating Electricity Concession Scheme) are applied through the retailer on proof of a Pensioner Concession Card, Health Care Card, Veteran (DVA) Gold Card, Queensland Seniors Card or ImmiCard. Records tie an account holder, customer or account number, NMI/MIRN or supply address to hardship program status, arrears, concession card details, payment plan amounts and "personal circumstances" notes. The incident class is a retailer's outsourced call-centre compromise exposing customer circumstances notes and government concession numbers. Published hardship policies, the AER guideline, blank applications and news are decoys.
Energy retailer account records that identify a customer as affected by family violence under Part 3A of the National Energy Retail Rules (rules 76A-76M): the account identification made under rule 76C, the preferred or safe method of communication the retailer must record under rule 76H(4), instructions not to disclose affected customer information (rule 76G) to a current or former joint account holder, and assistance notes such as fee or debt waivers, payment plans, hardship program entries and disconnection holds considered under rule 111(2A). Complements the sector-neutral au-dfv-* classifiers with energy account structure (NMI, MIRN, customer/account number, supply address).
Detects HR, payroll and timesheet records showing that a named or numbered employee has taken or requested family and domestic violence (FDV) leave, and employee DFV support and workplace safety plans. Under Fair Work Act 2009 ss106A-106E every national-system employee is entitled to 10 days of paid FDV leave, and Fair Work Regulations 2009 reg 3.48 prevents FDV leave from being shown on pay slips because the record itself discloses that the employee is experiencing violence. Queensland public sector and state-system employees have DFV leave under the Industrial Relations Act 2016 (Qld) ss 52-54, and Queensland public service employees have additional support under Public Service Commission Directive 03/20 "Support for employees affected by domestic and family violence": confidentiality of disclosures, risk assessment and safety planning, changes to work location, hours, email addresses and telephone numbers, removal of public contact details, secure parking, flexible working arrangements, and support to transfer or relocate. Enterprise agreements and other directives and policies use the same terms.
Detects completed Notices of Child Abuse, Family Violence or Risk filed in parenting proceedings in the Federal Circuit and Family Court of Australia (Family Law Act 1975 ss67Z, 67ZBA, 69ZQ(1)(aa)), including the earlier "Notice of Child Abuse, Family Violence or Risk of Family Violence" and the Family Court of Western Australia Form 4 "Notice of Child Abuse and Family Violence (or Risk)". The notice records allegations of child abuse or neglect, family violence, substance misuse, mental health issues and abduction threats against named parties and children, and child abuse allegations are reported to the prescribed child welfare authority.
Detects references to nationality/citizenship/immigration-status disclosure in Australian documents: nationality fields, national origin, citizenship status, visa status, and naturalization records. Not framed as an Art-9-style special category (Australia has no equivalent regime) — sensitivity here rests on immigration-status/visa risk under the Migration Act 1958 (Cth) and on the "national origin" limb of the Racial Discrimination Act 1975 (Cth), distinct from that Act's race/ethnicity limb covered by the sibling au-racial-ethnic-origin pattern. Topic-grade detector, low confidence by design.
NDIS records for a named participant: access requests (Access Request Form, Supporting Evidence Form), NDIS plans and budgets (Core, Capacity Building, Capital supports), plan reassessments, service agreements, support coordination and plan management records.
Reportable incident notifications and investigation records for a named NDIS participant: death, serious injury, abuse or neglect, unlawful sexual or physical contact, sexual misconduct and unauthorised use of a restrictive practice (24-hour immediate notification and 5-business-day report).
Queensland senior secondary applications for access arrangements and reasonable adjustments (AARA), including illness and misadventure, for a named student: diagnosis, medical practitioner report, functional impact and the arrangement sought for internal or external assessment.
Queensland Corrective Services Victims Register applications (Form 49), referrals (Form 49a), nominee registrations and notifications linking a registered victim or eligible person to a named offender (parole, discharge, escape, transfer, death). Around 60% of registrations relate to domestic and family violence.
Rates and water account records held by Queensland councils and water service providers that flag a ratepayer or water customer as affected by domestic and family violence and record the protective steps taken: a safe or preferred contact method, a suppressed or confidential postal or residential address, instructions not to disclose account details to a co-owner, joint account holder or former partner, account separation, redirected rate notices, and payment arrangements, interest waivers or holds on recovery or restriction action. Unlike energy (National Energy Retail Rules Part 3A) there is no verified Queensland statute that sets out these steps for councils or water providers; they come from council and utility hardship and DFV policies, with the Local Government Regulation 2012 s 120(1)(d) hardship concession and Information Privacy Act 2009 obligations in the background. Modelled on au-energy-family-violence-customer-record. Published council and utility DFV and hardship policies are decoys.
Notices ending a tenancy interest because of domestic and family violence (RTA Form 20, R20 for rooming accommodation), bond refunds for people experiencing DFV (Form 4a) and the supporting Domestic and Family Violence Report, identifying the tenant, the rental premises and the evidence of violence.
Completed registrations and entries in a Queensland council or Local Disaster Management Group vulnerable persons register (VPR), also called a special needs register or a register of persons requiring special assistance in a disaster or evacuation. A populated entry ties a named person and home address to disability, mobility or medical dependency (oxygen, dialysis, life sustaining equipment), a carer or emergency contact, and evacuation or transport needs. The Disaster Management Act 2003 does not create or name these registers. Councils keep them under the state framework "People with vulnerabilities in disasters: A framework for an effective local response" (2016) and their own local disaster management arrangements. Information acquired while performing a function under the Act is covered by the s 139 confidentiality offence. The Local Disaster Management Plan is public (s 60) but the register is not.
Completed enduring powers of attorney (Form 2 short form, Form 3 long form) and advance health directives (Form 4) under the Powers of Attorney Act 1998: principal and attorney details, financial and personal/health powers, life-sustaining treatment directions and capacity statements.
Elector-level records from ECQ's compulsory voting enforcement process: apparent failure to vote notices issued after a State or local government election (Electoral Act 1992 (Qld) s 134), elector responses giving a valid and sufficient reason for not voting or saying that they did vote and giving the details, payment records (s 135), infringement notices for failing to vote (s 186; LGEA 2011 ss 165, 166, 168), and referrals of unpaid notices to the State Penalties Enforcement Registry (SPER). ECQ's published process is apparent failure to vote notice, then infringement notice, then SPER referral. Excuses often disclose health conditions, hospital admissions, disability, bereavement, travel, religious duty (s 186(2)) or family circumstances. The "Do I have to vote?" page, penalty unit value statements, aggregate non-voter statistics and blank response forms are decoys.
OneSchool Support records and individual curriculum and learning plans for a named Queensland state school student (Individual Curriculum Plan, Individual Learning Plan). Behaviour support and student safety plans are covered by au-education-student-safety-behaviour-plan.
QCAT applications and orders appointing or reviewing guardians and administrators for adults with impaired decision-making capacity (Form 10), interim orders and supporting health-professional reports.
Positive behaviour support plans, restrictive practice approvals and authorisations for a named adult with disability: containment, seclusion, chemical, mechanical and physical restraint and restricted access to objects; short-term approvals by the Office of the Public Guardian and QCAT approvals under the Disability Services Act 2006 Part 6.
Records that identify a silent elector: completed AEC silent elector registrations (form ER022ESw_QLD, used for Queensland enrolment under the joint roll arrangement), silent elector registers, roll entries flagged silent, silent enrolment confirmations and special postal voter register entries for silent electors. A silent elector is a person whose address the Electoral Commission of Queensland has kept off the public roll because showing it would put the personal safety of the person or their family at risk (Electoral Act 1992 s 58(5) and sch 1; Commonwealth Electoral Act 1918 s 104, backed by a statutory declaration). Silent electors are automatically special postal voters (s 114(2)(b)), and council voters rolls must omit their address (LGEA s 19(2)). Nomination form guidance, fact sheets, AEC guidance, blank forms, legislation and news are decoys.
Applications for social housing and supporting records for a named household: Application for Social Housing, additional applicants, medical report (PH068), support statement (PH076), change of tenancy request (PH058), changes to household (PH127), transfer and mutual exchange applications, and Housing Service Centre assessments of housing need.
Detects special education and special needs learning plans for a named student - personalised learning plans, individual curriculum/education/support plans, Education Adjustment Program profiles and student support plans with disability, adjustment and goal details - when the plan phrase sits with populated student identifiers and plan fields.
Completed applications for financial assistance under the Victims of Crime Assistance Act 2009 (Qld) ss 51-52, made on the Victim Assist Queensland "Financial Assistance Application Form: Primary victim" (Form 1, Version 5, effective 14 September 2023) or recorded in Victim Assist case files: the primary victim's name and date of birth, the act of violence (what happened, key dates, offender name), police report details (reference number, station, investigating officer) or special primary victim report details (for example a domestic violence worker), injuries, recognition payment (special assistance) and recovery expense claims, and safe contact arrangements. Acts of violence include domestic and family violence, sexual offences and child abuse. The blank form, qld.gov.au application guidance and media coverage are decoys.
QTAC Educational Access Scheme applications and personal statements for a named applicant: disadvantage categories (personal illness or disability, English language difficulty, home environment and responsibilities, school environment, financial hardship) with supporting evidence.
Specialist Homelessness Services (SHS) client records and SHS collection extracts for named or linkable clients: homelessness status, reasons for seeking assistance, services provided and the statistical linkage key (SLK-581) built from name, date of birth and sex.
Telecommunications provider account records that identify a customer or end-user as an "affected person" under the Telecommunications (Domestic, Family and Sexual Violence Consumer Protections) Industry Standard 2025 (F2025L00664). Covers the agreed communication method recorded under s 10, the privacy, safety and security protections put on the account under ss 11-12 (PIN or password, verification code to a safe number or email, a new account not linked to the perpetrator), holds on and urgent reversal of a service limiting action under s 13, non-disclosure instructions under ss 25 and 27, privacy breach notifications to the affected person and the ACMA under s 29, and the record of the type of evidence sought, provided and sighted under ss 14 and 30-31. Most of the Standard commenced on 1 January 2026 (1 April 2026 for small providers); some provisions commenced on 1 July 2025. This is the telco counterpart of au-energy-family-violence-customer-record, with telco account structure (account or customer number, service or mobile number, MSISDN).
Tertiary student disability access and adjustment plans for a named student: condition or diagnosis and the academic adjustments granted. Plan names vary by institution (UQ Student Access Plan, QUT Access Equity Plan, UniSC and Bond Learning Access Plan, CQU Accessibility Plan, UniSQ Learning Support Plan, JCU AccessAbility Services Access Plan).
Row-level workforce diversity and equal employment opportunity (EEO) extracts: HRIS or payroll exports prepared for Workplace Gender Equality Agency (WGEA) reporting, Queensland public sector MOHRI workforce data and the workforce diversity census, equity and diversity audits under the Public Sector Act 2022 (Qld) ss 27-29, and internal diversity dashboards' source data. Each row ties an employee identifier to diversity attributes such as Aboriginal and / or Torres Strait Islander status, disability, culturally and linguistically diverse (CALD) or non-English speaking background, language spoken at home, country of birth, gender and, where collected, sexuality. Aggregate reports, published workforce statistics and survey questionnaires are out of scope.
Complaints, reports and case records about sexual harassment, sex-based harassment, workplace bullying and psychosocial hazards that name the people involved: complainant and respondent details, incident date, location and alleged conduct, interim measures, investigation and outcome. Anchored on the Sex Discrimination Act 1984 (Cth) s 47C positive duty, the Work Health and Safety Regulation 2011 (Qld) psychosocial risk provisions (Part 3.2 Division 11) and the Managing the risk of psychosocial hazards at work Code of Practice 2022 (Qld). Overlaps global-top500-064-employee-grievance-reports and global-top500-079-workplace-investigation-files (generic phrase classifiers); this one requires populated party and incident fields.
Detects biometric data about an identified person - biometric templates, identifiers and records, fingerprint scans or templates, facial recognition, iris/retina scans, voiceprints and palm prints - when the biometric phrase sits with a populated person identifier and biometric enrolment/capture fields.
Detects encoded biometric template artifacts rather than the word "fingerprint". Matches the ISO/IEC 19794 family modality magic markers (FMR\0 finger minutiae, FIR\0 finger image, FAC\0 face, IIR\0 iris — also the ANSI/INCITS 378 FMR header) and base64 blobs explicitly labelled as a biometric / fingerprint / iris / face template. Real biometric exfiltration moves as encoded templates, not plaintext.
Detects person-linked Aboriginal and Torres Strait Islander data - Indigenous status and origin fields and Indigenous data, health data or identifiers attached to an identified person record - as well as discovery-grade Indigenous data governance references.
Detects references to nationality/citizenship/immigration-status disclosure: nationality fields, national origin, citizenship status, visa status, and naturalization records. Unlike the three sibling Art-9 patterns in this wave (sexual-orientation, religious-beliefs, racial-ethnic-origin), nationality is NOT a GDPR Article 9 special category — it is processed under GDPR's ordinary Article 6 lawful-basis regime. It is grouped with the Art-9 set here because it shares the same detection problem (an attribute value with no fixed format) and was bundled with them in the C3 deprecation/gap analysis, and because national origin carries real discrimination risk. Topic-grade detector, low confidence by design.
Detects references to neural / neurotechnology data: brain-computer interface signals, EEG/EMG recordings, evoked potentials, neural decoding output and neurofeedback data. Colorado HB24-1058 and California SB 1223 both classify neural data as sensitive personal information. Topic-grade vocabulary detector, not a fixed-format detector.
Detects references to political opinions and party affiliation: party membership, voter registration by party, political donations and campaign contributions. GDPR Article 9 lists political opinions as a special category of personal data with no fixed format — it is detectable only by topic vocabulary. Topic-grade detector, low confidence by design.
Detects racial or ethnic origin information in person-linked demographic, workforce, intake, census, application, and case records. The detector recognises explicit racial/ethnic-origin phrases and structured race or ethnicity fields, then raises confidence only when the same span contains a data-subject record and a populated attribution. Racial or ethnic origin is protected under GDPR Article 9 and Australian anti-discrimination and privacy law. Topic-grade detector, low confidence by design.
Detects religious or philosophical belief information in person-linked membership, patient, workforce, census, pastoral-care, and accommodation records. The detector recognises explicit belief, affiliation, observance, denomination, and structured religion-field terminology, then raises confidence only for person records and populated belief or accommodation statements. Religious or philosophical beliefs are protected under GDPR Article 9 and Australian anti-discrimination and privacy law. Topic-grade detector, low confidence by design.
Detects sexual-orientation information in person-linked workforce, patient, survey, member, relationship, intake, and case records. The detector recognises the explicit sexual orientation phrase, orientation-specific identification statements, coming-out statements, and same-sex partner or spouse references, then raises confidence only for person records and populated attributions. It deliberately excludes transgender status, gender identity, and pronouns because those are distinct attributes. Sexual orientation is protected under GDPR Article 9 and Australian anti-discrimination and privacy law. Topic-grade detector, low confidence by design.
Identifies documents containing references to biometric identifiers in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Identifies documents containing references to handwritten signatures in Australian contexts. This remains a concept detector over manual/wet/ink/specimen signature wording — it does not inspect handwriting pixels or capture a signature image. Bare "signed by" attribution (common in electronic/typed signature text) is corroborating evidence only, not a primary indicator.
Identifies documents containing references to genetic data in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Identifies individual disability assessment records - disability and functional capacity assessments, NDIS access requests, disability support pension impairment assessments and standardised functional assessment reports - when the phrase sits with populated person identifiers and assessment fields. Health and disability information under applicable privacy law.
Identifies documents containing references to politically exposed person assessment files in international contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Detects references to trade union membership: union member status, union dues, shop stewards, collective bargaining unit membership and union local numbers. GDPR Article 9 lists trade union membership as a special category of personal data with no fixed format — detectable only by topic vocabulary. Topic-grade detector.
Detects Aadhaar patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.